HappyGoLuckyPH Group Claims Massive Network Breach and Defacement Targeting DMW
The hacktivist group, HappyGoLuckyPH has claimed responsibility for a major cyber incident involving the defacement of a Department of Migrant Workers (DMW) web portal and an extensive breach of the agency's internal network infrastructure.
The intrusion resulted in the defacement of the agency alongside claims of deep administrative compromise, exposing core databases, operational files, and tens of thousands of identity records.
https://iili.io/ndsgsWJ.png
The incident came to light after the DMW subdomain homepage was replaced with a manifesto titled "Walang Natira by: Gloc9". In their posted statement, HappyGoLuckyPH claimed to have maintained persistent access within the agency's Active Directory environment for over a month, culminating in the compromise of a central Domain Controller.
https://iili.io/ndsggHP.png
https://iili.io/ndsg4OF.png
The actors asserted that they intentionally generated network noise and pinged active firewalls to test whether government IT personnel would detect their presence, framing the intrusion as a crusade against systemic corruption and administrative negligence rather than a financial cybercrime.
https://iili.io/ndsgixa.png
https://iili.io/ndsg6Dg.png
Technical evidence provided by the group demonstrates extensive control over internal system interfaces:
• Domain & Network Control: Screenshots display active Remote Desktop Protocol (RDP) sessions on a central Domain Controller, giving the actors visibility over active directories, staff accounts across ICT and Management Information Technology System (MITS) divisions, and network permissions.
• Security Monitoring: The group accessed endpoint management consoles running Sophos protection suites, enabling real-time tracking of security alerts, updates, and system events.
• Server Directories: Open administrative file paths show direct access to web server environments and backend operational modules.
Log outputs and file listings leaked by the threat actors detail significant data exfiltration and exposure across multiple core agency databases:
• Passport & Identification Records: Logs from POEA_EServices__KYCIdentification show access to 54 separate data files totaling 13.8 GB. The actors claimed to have decoded base64 image strings containing over 140,000 scanned passports and government IDs submitted between 1999 and 2026.
• Contract & Overseas Employment Databases: Exposed PowerShell directory dumps revealed database backups (.bak), including BMContracts.bak (13.3 GB), eContractsDB.bak , and POEA_EServices.bak (19.4 GB), housing official contract processing and deployment histories.
• User Accounts & Registrations: Profiles and online activity logs were exposed across BMOnline.bak (12.8 GB), CAEPOnline.bak (20.1 GB), and OfwDB.bak (951 MB).
• Financial Routing & Agency Records: Administrative access extended to agency financial logs and recruitment database back-ends, such as CashierDB.bak (5.16 GB), LandBankDB.bak (3.99 GB), AgencyDB.bak (898 MB), and AccreditationDB.bak (25.9 GB).
• Legal & Repatriation Histories: Case logs tracking worker disputes, emergency assistance, and overseas returns were exposed in AdjudicationDB.bak (272 MB) and RepatriationDB.bak (429 MB).
HappyGoLuckyPH warned that the long-term exposure of unencrypted backup files leaves the infrastructure highly vulnerable, noting that other malicious actors may have exfiltrated the same repositories undetected.
We should emphasize that compromising an Active Directory domain controller requires complete credential resets, thorough malware sweeps, and network isolation to prevent persistent access.
Government authorities have yet to issue an official technical assessment regarding the status of the affected servers or containment progress.
